The short version: A Civil Investigative Demand is not a lawsuit. It’s a formal document request the Department of Justice sends before it decides whether to file one. If you got one about your PPP loan, the single most important thing you can do in the next 48 hours is retain an attorney who has handled False Claims Act civil investigations. Everything else follows from that.
What a CID actually is
The Civil Investigative Demand is a creature of the False Claims Act, a Civil War-era statute the federal government uses aggressively to recover money it believes was obtained through fraud. Under the FCA, the DOJ can issue a CID to any person or entity it thinks possesses relevant documents, data, or testimony — and you don’t have to be the named target for one to land on your desk.
You can’t simply ignore a CID. It comes with binding deadlines: typically 20 days to respond to written interrogatories and 30 days to produce documents, though both can be extended by agreement with the government. Extensions are common, especially when new counsel needs time to get oriented. But you have to ask for them before the deadline passes, not after.
The DOJ sends CIDs at the pre-complaint stage, which means they haven’t sued you yet — but they are actively considering it.
The PPP context matters here. Roughly 11 million PPP loans, totaling about $800 billion, were issued between 2020 and 2021. The DOJ has worked through that pool methodically since 2021, charging thousands of defendants across criminal and civil PPP fraud cases — see the department’s COVID-19 fraud enforcement page for the running tally. The DOJ uses civil CIDs to develop the civil side of those investigations — it is a standard tool, not an escalation.
Don’t panic. But don’t wait.
The worst thing you can do is put the CID on a shelf and hope something changes. Nothing will. The second worst thing is to start pulling documents together and responding without counsel.
Don’t.
It sounds manageable — you know your own loan better than anyone. But responding without an attorney means you can inadvertently waive attorney-client privilege over materials you meant to protect, produce documents in a format or scope that creates new problems, or write things in a cover letter that the DOJ will quote back at you later. These are not hypothetical risks.
There is no penalty for taking a day or two to read the CID carefully before making any calls. There is a real penalty for missing the response deadline without having first requested an extension. So before anything else, find that date in the document. Then get a lawyer.
Your first 48 hours
First, find an attorney with actual False Claims Act civil experience — not your regular business attorney. Not the lawyer who handled your last commercial lease or helped you set up the entity. You need someone who knows FCA civil practice in federal court — ideally someone familiar with the Civil Division attorneys at the relevant U.S. Attorney’s office, or who has handled PPP-specific matters through the full investigation cycle. Ask directly: how many FCA civil investigations have you handled, and what were the outcomes?
At the same time, issue a litigation hold. Instruct every employee, officer and manager to preserve all documents, emails, texts and Slack messages related to your PPP loan: the original application, the forgiveness application, payroll records, bank statements, and any communications about how the funds were spent. Do not delete anything. Do not “clean up” old emails. Do not let anyone do routine document retention destruction while this investigation is open. The DOJ treats evidence destruction seriously, and what starts as a civil CID can become a criminal obstruction charge if documents disappear after you received formal notice.
Do not speak to anyone from the DOJ or SBA without your attorney present. This includes SBA auditors, DOJ investigators, and any caller claiming to represent a federal agency. Be polite. Take their name and contact information. Tell them your attorney will be in touch. That is the entire conversation.
Do not discuss the substance of the investigation with your employees. You can and should tell them to preserve documents. But coaching testimony — even informally, even with good intentions — is a serious legal risk that can transform a civil matter into something worse.
Areas of government scrutiny
PPP CIDs typically focus on a recurring set of issues. The CID itself will tell you which ones the government cares about in your case. The most common are:
Need Help With Your Case?
Don't face criminal charges alone. Our experienced defense attorneys are ready to fight for your rights and freedom.
- 100% Confidential
- Response Within 1 Hour
- No Obligation Consultation
Or call us directly:
(212) 300-5196- Eligibility. Did your business actually qualify for the loan size you requested? Inflated payroll figures on the application are the most common issue the DOJ has pursued.
- Use of funds. PPP funds were supposed to go to payroll, rent, mortgage interest and utilities. Were your actual expenditures within those categories?
- Forgiveness certifications. If you applied for forgiveness, did your certifications accurately reflect how and when the money was spent during the covered period?
- Affiliation rules. Some larger businesses applied through subsidiaries in ways designed to circumvent the program’s size limits. The DOJ has scrutinized this carefully.
- The economic necessity certification. Every borrower certified that “current economic uncertainty makes this loan request necessary to support the ongoing operations of the Applicant.” The government has challenged this certification aggressively, particularly for businesses that had significant cash reserves when they applied.
Read the CID carefully with your attorney. The specific document requests and interrogatories will tell you where the government thinks your exposure lies.
How cases resolve
The DOJ’s process has a few distinct possible outcomes, and understanding them early helps you and your attorney calibrate the right response posture.
Many investigations close without any filing. The DOJ reviews the materials and closes without action — particularly when the loan was relatively small, when the irregularities look like honest confusion about program rules rather than deliberate fraud, and when the business cooperated clearly and organized its response well from the beginning rather than producing documents in a way that forced the government to piece the story together on its own.
Sometimes the DOJ offers to resolve the matter through a civil settlement under the FCA, without going to court. These settlements typically involve repaying the loan amount plus FCA penalties (which can be substantial), and they usually come with a public announcement. Businesses that cooperate early and fully tend to reach better settlement terms than those that stonewall and then settle only after the government has obtained everything it needs anyway.
The most serious outcome is a criminal referral, which tends to arise when the fraud was intentional, large in scale, or involved fabricated documents. If you have any reason to think criminal exposure is possible — because you knew the application contained false numbers, for example — your attorney needs to assess that risk before you produce a single document. The strategy for a case with criminal exposure is different from the strategy for a purely civil matter.
Not all CIDs start with the DOJ. Some originate with a whistleblower who already filed a sealed qui tam complaint under the FCA. The DOJ’s CID may be part of its investigation into whether to intervene in that case. Your attorney can sometimes determine whether a qui tam suit is pending in the background, though the government won’t always confirm it.
On cooperation
Honestly, the question of how much to cooperate doesn’t have a universal answer.
Todd Spodek
Lead Attorney & Founder
Featured on Netflix's "Inventing Anna," Todd Spodek brings decades of high-stakes criminal defense experience. His aggressive approach has secured dismissals and acquittals in cases others deemed unwinnable.
One school of thought holds that proactive, thorough cooperation signals good faith and tends to produce better outcomes — declinations and lower settlement penalties. The other view is that cooperating fully just makes the government’s case easier to build, and that a more measured response, producing only what is clearly required, is the wiser approach.
Both views have real merit, and the right answer depends on what is actually in your documents and how strong a case the government can assemble with or without your full help. A good FCA attorney will help you assess this before any production decision.
What cooperation does not mean is handing over everything without scrutiny. CIDs can be overbroad. You have a right to object to requests that are unduly burdensome, seek privileged information, or exceed the legitimate scope of the investigation. Good FCA counsel will push back where the request overreaches. The DOJ’s Civil Division expects and is accustomed to these negotiations — they’re part of the process, not a sign of obstruction.
You submitted a PPP loan application during COVID and now realize some employee count numbers may have been inaccurate.
Could this be considered fraud?
Inaccuracies in PPP applications can trigger federal fraud charges carrying up to 20 years in prison. However, honest mistakes differ from intentional misrepresentation. Documentation of your good-faith efforts is critical to your defense.
This is general information only. Contact us for advice specific to your situation.
The timeline is longer than you think
The False Claims Act has a 10-year statute of limitations for civil cases. PPP loans made in 2020 remain actionable through 2030. Loans from 2021 through 2031. If you received a CID in 2025 or 2026 about a loan that is now five years old, you are not the tail end of an enforcement sweep that is winding down. You are in the active middle of one that still has years to run.
The DOJ’s PPP program has continued well past the initial wave of high-profile criminal prosecutions. Civil enforcement has tracked behind criminal enforcement by design — civil matters take longer to develop and often rely on evidence gathered in parallel criminal investigations. The cases being built now, in 2026, may be drawing on evidence collected years earlier.
The bottom line
A CID is a formal notice that the government is looking at your loan and wants to understand what happened — not a complaint, not a conviction. Businesses that respond thoughtfully — with experienced FCA counsel, well-organized records, and a clear narrative about what they did and why — often get through this without litigation. But that window closes faster than most people expect.
Get a lawyer, issue a hold, and respond carefully. That order matters.
